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Rff MARKS 

The Examiner has revised the current rejection in light of new prior art and a 
reformulated rejection. While applicant continues to disagree with the Examiner, 
applicant has incorporated the subject matter of at least one dependent claim into each of 
the independent claims in the spirit of expediting the prosecution of the present 
application. Since the subject matter of such dependent claim(s) was already considered 
by the Examiner, it is asserted that such claim amendments would not require new search 
and/or consideration. 

The Examiner has rejected Claims 1-32 and 34 under 35 U.S.C. 1 03(a) as being 
unpatentable over Nessett et al. (U.S. Patent No. 5,968,176) and further in view of Reid 
et al. (U.S. Patent No. 6,182,226) in view of Kephart (U.S. Patent No. 5,452,442). 
Applicant respectfully disagrees with such rejection, especially in view of the 
amendments made hereinabove. Specifically, applicant has amended each of the 
independent claims to include the subject matter of Claim 32. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438(Fed.Cir,1991). 

With respect to the first element of the prima facie case of obviousness and, in 
particular, the obviousness of combining the aforementioned references, the Examiner 
argues that a person having ordinary skill in the art would have readily recognized the 
desirability and advantages of modifying Nessett by employing a firewall capable of 
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virus scanning to scan for known types of malicious programs or data, as in Reid et al., in 
order to further improve the level of security provided by a firewall to prevent malicious 
attacks from incurring on a target system, The Examiner also argues that a person having 
ordinary skill in the art would have readily recognized the desirability and advantages of 
modifying Nessett in view of Reid et aL, by scanning for virus signature files, such as 
disclosed by Kephart, in order to accurately monitor for viruses, and distinguish false 
alarms from regularly executing programs, To the contrary, applicant respectfully asserts 
that it would not have been obvious to combine the teachings of the Nessett, Reid and 
Kephart references, especially in view of the vast evidence to the contrary. 

For example, Nessett relates to a Network Interface Card (NIO firewall, while 
Reid relates to external firewalls . To simply glean features from a NIC firewall, such as 
that of Nessett, and combine the same with the non-analogous art of external firewalls. 
such as that of Reid would simply be improper. External firewalls protect multiple 
computers, while a NIC firewall protects the computer to which it is attached. "In order 
to rely on a reference as a basis for rejection of an applicant's invention, the reference 
must either be in the field of applicant's endeavor or, if not, then be reasonably pertinent 
to the particular problem with which the inventor was concerned. " In re Oetiker, 977 R2d 
1443, 1446, 24 USPQ2d 1443, 1445 (Fed. Cir. 1992). See also In re Deminski, 796 F.2d 
436, 230 USPQ 313 (Fed. Cir. 1986); In re Clay, 966 F.2d 656, 659, 23 USPQ2d 1058, 
1060-61 (Fed. Cir. 1992) In view of the vasdy different types of problems a NIC firewall 
addresses as opposed to an external firewall , the Examiner's proposed combination is 
inappropriate. 

In addition, contrary to the Examiner's arguments, applicant's claimed feature 
would have been unobvious in view of Reid, since Reid' external firewalls teach away 
from any sort of processor positioned on a network adapter coupled between a computer 
and a network. In re Hedges* 783 F.2d 1038, 228 USPQ 685 (Fed. Cir. 1986). 

Further, as noted above, Nessett relates to a firewall, while Kephart relates solely 
to virus scanning. To simply glean features from a firewall such as that of Nessett, and 
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combine the same with the non-analogous art of virus scanner, such as that of Kephart 
would simply be improper. Firewalls protect computers using rule-based filtering, while 
a virus scanner performs signature-based scanning. In view of the vastly different types 
of problems a firewall addresses as opposed to a virus scanner, the Examiner's proposed 
combination is again inappropriate. 

To this end, applicant respectfully asserts that it would not have been obvious to 
combine the teachings of the Nessett, Reid and Kephart references, as noted above. 
Nevertheless, despite such paramount deficiencies and in the spirit of expediting the 
prosecution of the present application, applicant has included the subject matter of Claim 
32 et al. in each of the independent claims. 

With respect to the subject matter of Claim 32 (now incorporated into each of the 
independent claims), the Examiner has relied on Kephart to meet applicant's claimed 
technique "wherein the virus signature files are stored on non-volatile solid state memory 
on the network adapter." Further, the Examiner argues that "Nessett et al. in view of 
Reid et al. in view of Kephart further disclose that h would have been obvious to store the 
signature files on a non-volatile solid state memory on the network adapter since virus 
scanning is performed on the network adapter, it would be obvious that the signature files 
be located along with the virus scanner." 

Applicant respectfully disagrees. Virus scanning on a network adapter, in and of 
itself, in no way makes it obvious that "the signature files be located along with the virus 
scanner," as purported by the Examiner. Just by way of example, the files may be stored 
on a host computer and retrieved as necessary to perform scanning. 

Further, it appears that the Examiner has still not taken into consideration the full 
weight of applicant's claims. Specifically, the Examiner's proposed combination fails to 
even suggest a technique "wherein the virus signature files are stored on non-volatile 
solid state memory on the network adapter" (emphasis added). Such non-volatile feature 
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provides numerous optional advantages such as scanning at boot-up (before signatures 
can be loaded into memory post-boot-up), etc. 

Thus, with respect to the third element of the prima facie case of obviousness, 
applicant respectfully asserts that the prior art references, when combined, fail to teach or 
suggest all of the claim hmitations. A notice of allowance or a specific prior art showing 
of all of applicant's claim limitations, in combination with the remaining claim elements, 
is respectfully requested. 

The Examiner's rejections remain deficient with respect to the dependent claims, 
since such rejections also do not meet each and every element of the prima facie case. 
For example, with respect to dependent Claim 6 et al., the Examiner has relied on Col. 7, 
lines 9-21 in Nessett to make a prior art showing of applicant's claimed technique 
"wherein the manner in which the scanning is performed is capable of being user- 
configured." Applicant respectfully asserts that such excerpt merely discloses filtering 
rules. Clearly, filtering rules do not meet applicant's specific claim language, namely 
"the manner in which the scanning is performed" (emphasis added) since filtering rules 
only identify types of data that may be allowed access, and not seating, as claimed. 

With respect to Claim 11 et al., the Examiner has relied on Col. 23, lines 18-26 in 
Nessestt to make a prior art showing of applicant's claimed technique "wherein the 
processor is capable of scanning received packets that are of interest." The Examiner 
further states that scanning is implied fiom the ability to distinguish between the different 
protocols. Applicant asserts that the Examiner has failed to consider the full weight of 
applicant's claim language. Applicant claims "scanning received packets that are of 
interest, " (emphasis added), and not simply scanning received packets to determine if 
they are of interest, as in Nessett. 

With respect to Claim 30, the Examiner has relied on Col. 17, lines 9-21 in 
Nessett to make a prior art showing of applicant's claimed technique "wherein the 
content scanning enforces operational policies of an organization." Applicant 
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respectfully asserts that such excerpt only generally teaches managing security policy 
data. Clearly, managing security policy data for the operation of security systems, as in 
Nessett, does not meet any sort of content scanning, and especially not content scanning 
that "enforces operational policies in an organization/' as specifically claimed by 
applicant. 

Again, a notice of allowance or a specific prior art showing of each of such claim 
limitations, in the context of the remaining elements, is respectfully requested. 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

Reconsideration is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P056/01. 187.01). 
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